FDA 21 CFR Part 11 Compliance Checklist
Practical Part 11 checklist covering electronic records, electronic signatures, audit trails, and controls.
21 CFR Part 11 is the FDA rule governing electronic records and electronic signatures in regulated industries. It applies when a record required by a predicate rule is created, modified, maintained or submitted electronically. Compliance rests on three things: validated systems, secure computer-generated audit trails, and electronic signatures that are permanently linked to the record they sign.
- 1The signer’s printed name
- 2When it was signed
- 3What the signature means
- 4Credentials entered again at signing
Scope — does Part 11 even apply?
The most expensive Part 11 projects are the ones that never asked this question. Part 11 applies to records a predicate rule requires you to keep, not to every file in the business.
- 1
Predicate rule identified
The specific GMP, GCP or GLP regulation requiring the record is named. No predicate rule, no Part 11 obligation.
- 2
Record inventory
Lists which records in the system are regulated electronic records, and which are copies or convenience views.
- 3
Open or closed system determination
States whether people responsible for record content control system access. Open systems carry the additional §11.30 obligations.
- 4
Hybrid approach documented
If wet-ink signatures sit against electronic records, the link between the two is defined and controlled.
§11.10 — controls for closed systems
The core of the rule. Each item below maps to a lettered sub-clause, and each one needs a configuration or procedure you can point at.
- 5
System validation (a)
Documented evidence the system performs as intended and can detect invalid or altered records.
- 6
Accurate copies (b)
The system can produce complete, readable copies in both human-readable and electronic form for inspection.
- 7
Record protection (c)
Records remain retrievable and readable for their full retention period, including after a system upgrade or migration.
- 8
Access limitation (d)
Only authorised individuals can use the system. Role definitions are documented and periodically reviewed.
- 9
Audit trail (e)
Secure, computer-generated, time-stamped, records who did what and when, captures the previous value on change, and cannot be switched off by users.
- 10
Operational sequencing (f)
The system enforces the correct order of steps where sequence matters.
- 11
Authority checks (g)
The system verifies the person is authorised for that specific action, not merely logged in.
- 12
Device checks (h)
Where data source matters, the system validates the instrument or terminal supplying it.
- 13
Personnel qualification (i)
Training records show users are qualified for the tasks they perform in the system.
- 14
Accountability policy (j)
A written policy holding individuals accountable for actions taken under their electronic signature.
- 15
Documentation control (k)
System documentation is version-controlled and its distribution is managed.
§11.30 — additional controls for open systems
- 16
Encryption in transit and at rest
Applied where record content could be altered by parties outside your control.
- 17
Digital signature standards
Where used, the signature method is documented and appropriate to the risk.
§11.50 and §11.70 — signature manifestations and linking
- 18
Printed name of the signer
Appears in the signed record and on any human-readable copy.
- 19
Date and time of signing
Captured by the system, not entered by the user, with the time zone unambiguous.
- 20
Meaning of the signature
States whether it is authorship, review or approval. 'Signed' alone is not a meaning.
- 21
Signature-to-record linking
The signature cannot be excised, copied or transferred to another record. Signed content is frozen.
§11.100–11.300 — electronic signature controls
- 22
Signature uniqueness
Each signature belongs to one individual and is never reused or reassigned.
- 23
Identity verification
The organisation verified the identity of each individual before issuing their signature.
- 24
FDA certification letter
A letter certifying that electronic signatures are the legally binding equivalent of handwritten signatures has been submitted to the agency.
- 25
Two distinct components
Non-biometric signatures use two components, typically user ID and password.
- 26
Re-authentication at signing
A continuous session re-authenticates on the first signing; subsequent signings use at least one component. Separate sessions require both.
- 27
Password controls
Ageing, complexity, uniqueness and revocation are enforced by the system, and loss-management procedures exist.
- 28
Segregation of duties
An author cannot approve their own record. The system enforces this rather than relying on procedure.
Part 11 is a US FDA rule. EU GMP Annex 11 covers much of the same ground with different emphasis — if you operate in both regions, assess against both rather than assuming one satisfies the other.
A frequent and costly finding: an audit trail that exists but is not reviewed. Part 11 expects audit trail review to be part of the batch or record review process, with a defined frequency and a record that it happened.
This is a working aid, not a regulatory document, and it does not replace your own quality system procedures.
Explore related resources, products and services: GxP Copilot, TraceDraft, validation services, AI transformation.
Sources
Primary documents referred to on this page, from their official publishers.
- 21 CFR Part 11: Electronic Records; Electronic Signatures · eCFR (US)
- EudraLex Volume 4: EU Good Manufacturing Practice guidelines · European Commission
- EU GMP Annex 11: Computerised Systems (current version) · European Commission
Common questions
Prefer to talk first? Chat with us on WhatsApp or book a call with an expert.
What is 21 CFR Part 11?
It is the FDA regulation covering electronic records and electronic signatures. It applies when a record required by a predicate GMP, GCP or GLP rule is created, modified, maintained or submitted electronically, and it requires validated systems, secure computer-generated audit trails, and signatures permanently linked to the records they sign.
Does Part 11 apply to every system we use?
No. It applies only where a predicate rule requires the record. A system holding convenience copies, or data no regulation obliges you to keep, falls outside it. Identifying the predicate rule first is the single biggest scope saving available on a Part 11 project.
What makes an audit trail Part 11 compliant?
It must be secure, computer-generated and time-stamped, record who performed each action and when, capture the previous value whenever a record is changed, and be impossible for users to disable or edit. It must also remain available for the full record retention period, and be reviewed as part of record review.
What are the three parts of a compliant electronic signature?
Under §11.50 the signed record must show the printed name of the signer, the date and time of signing captured by the system, and the meaning of the signature — authorship, review or approval. Under §11.70 that signature must be permanently linked to the record so it cannot be copied or transferred.
Do we need to tell the FDA we use electronic signatures?
Yes. Under §11.100(c) the organisation must submit a certification letter to the FDA stating that electronic signatures used in its systems are the legally binding equivalent of handwritten signatures. It is submitted once for the organisation, not per system, and its absence is a straightforward finding.
Put this to work on your system.
Bring a URS. We show you risk-sized testing on your own requirements.
- We reply within one business day
- We run your URS live on the call
- You get a clear plan for your system